CVE-2026-72678
Description
A flaw was found in Elasticsearch. An authenticated user with read privileges can submit a crafted request that causes the node to attempt an excessively large memory allocation due to unvalidated user input. This memory exhaustion leads to a fatal error, terminating the Elasticsearch node process and causing a Denial of Service (DoS) for the affected node. A single request is sufficient to trigger this issue.
Statement
An unvalidated allocation flaw exists in Elasticsearch's API request processing mechanisms. When handling user-supplied size parameters during data structure initialization, Elasticsearch fails to bound memory allocation requests. An authenticated remote user with read-only privileges can submit a single crafted API request, forcing an excessively large heap allocation that triggers an Out-Of-Memory (OOM) fatal error and crashes the node process. This results in service disruption and degraded cluster health, posing a high impact to availability.
Mitigation
Restrict API access permissions using Elasticsearch role-based access control (RBAC) so that only trusted users can access read endpoints. Additionally, configure request circuit breakers (`indices.breaker.request.limit`) to enforce strict memory allocation caps per request execution.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
